S02 D.11 VHA DIRECTIVE 1412 (1) CANCER REGISTRY SYSTEM.pdf

T-1

Department of Veterans Affairs Veterans Health Administration Washington, DC 20420

VHA DIRECTIVE 1412(1)

Transmittal Sheet

May 29, 2019

DEPARTMENT OF VETERANS AFFAIRS CANCER REGISTRY SYSTEM

1. REASON FOR ISSUE: The Department of Veterans Affairs (VA) requires each VA medical facility to maintain a cancer registry to identify and collect data on patients diagnosed, clinically or pathologically, and/or treated for diseases outlined in the current VA Cancer Registry’s System (VACRS) reportable list. NOTE: The cancer registry might not include patients who are receiving or have received care from non-VA health care provides.

2. SUMMARY OF MAJOR CHANGES.

a. Amendment dated April 7, 2020, incorporates VHA Directive 1072, Release of VA Data to State Cancer Registries, outlining responsibilities prior to VA releasing or disclosing data to a State Cancer Registry. A Data Use Agreement template for release of that data is also included. NOTE: The Date Use Agreement Template can be found in Appendix B.

b. This directive outlines and clarifies the responsibilities of Veterans Health Administration (VHA) personnel centrally and at medical facilities related to support and operation of VA’s Cancer Registry Systems including data collection requirements and reporting timelines.

3. RELATED ISSUES: None.

4. RESPONSIBLE OFFICE: The Office of Specialty Care Services (10P11) is responsible for the contents of this directive. Questions may be referred to the System Supervisor, VACRS at 202-461-7120. Questions about cancer care may be referred to cancer@va.gov.

5. RESCISSIONS: VHA Directive 1072, Release of VA Data to State Cancer Registries, dated July 23, 2014.

6. RECERTIFICATION: This VHA directive is scheduled for recertification on or before the last working day of May 2024. This VHA directive will continue to serve as national VHA policy until it is recertified or rescinded.

BY DIRECTION OF THE OFFICE OF

THE UNDER SECRETARY FOR HEALTH:

/s/ Lucille B. Beck, PhD.

Deputy Under Secretary for Heath for Policy and Services

AMENDED

April 7, 2020

Attachment D.11 36C25522Q0114 mailto:cancer@va.gov

May 29, 2019 VHA DIRECTIVE 1412(1)

T-2

NOTE: All references herein to VA and VHA documents incorporate by reference subsequent VA and VHA documents on the same or similar subject matter.

DISTRIBUTION: Emailed to the VHA Publication Distribution List on May 30, 2019.

i

CONTENTS

DEPARTMENT OF VETERANS AFFAIRS CANCER REGISTRY SYSTEM

1. PURPOSE

2. BACKGROUND

3. DEFINITIONS

4. POLICY

5. RESPONSIBILITIES

6. TRAINING

7. RECORDS MANAGEMENT

8. REFERENCES

APPENDIX A

VA CANCER REGISTRY REPORTING .............................................................. A-1

APPENDIX B

DATA USE AGREEMENT (DUA) WITH NON-FEDERAL ENTITIES .................. B-1

APPENDIX C

LETTER REQUIREMENTS ................................................................................. C-1

DEPARTMENT OF VETERANS AFFAIRS CANCER REGISTRY SYSTEM

1. PURPOSE

This Veterans Health Administration (VHA) directive establishes the policy for VHA personnel, in both VHA Central Office Department of Veterans Affairs (VA) medical facilities, who are responsible to support and operate the VA Cancer Registry System (VACRS), including requirements for data collection and reporting, and timelines for reporting. NOTE: The cancer registry might not include patients who are receiving or have received care from non-VA health care provides. AUTHORITY: Public Law (Pub.

L.) 104-191, implemented by 45 CFR Parts 160 and 164; Title 5 United States Code (U.S.C.) 552a; and Title 38 U.S.C. 7301(b).

2. BACKGROUND

a. The VA Cancer Registry System provides a systematic approach to (1) identifying patients with a diagnosis of cancer, (2) gathering standardized structured information about each patient with cancer, and (3) generating reports on the population of patients with cancer in VA health care. Data in the VA Cancer Registry System includes patient demographics (e.g., place of birth, race, Spanish origin, sex, primary cancers (e.g., epidemiological, staging, survival, and other clinical data) and is utilized for purposes such as documenting follow-up status, outcome evaluation, and program assessment.

b. Cancer registry data is vital for VA health professionals, policy administrators, researchers, and the public as it provides vital information about newly diagnosed cancer cases (incidence), treatment of cancer, recurrence of cancer and deaths from cancer (mortality). This data is required to understand and address the VA’s cancer burden and patient management as well as program assessment, planning and strengthening of oncology care. Specifically, cancer registry data is used to:

(1) Assist in the care of individuals with cancer;

(2) Monitor cancer trends over time;

(3) Illustrate cancer patterns in various VA populations and identify high-risk groups;

(4) Evaluate the strength and quality of cancer programs;

(5) Understand and plan for the impact of new diagnostic tests and treatments on VA health resources; and

(6) Contribute to VA clinical, epidemiologic, and health services research.

c. The VA Cancer Registry System (VACRS), a national cancer registry, is established in the Office of the National Program Director for Oncology. It is composed of local medical facility cancer registries and aggregations of data from local medical facility cancer registries. VACRS requires each VA medical facility cancer registry to identify and report data on patients diagnosed (clinically or pathologically) and/or treated for diseases outlined in the current VACRS reportable list. VACRS will prepare and distribute a list of reportable diagnoses annually from the International Classification of Diseases - Oncology (ICD-O-3) manual. For more information, see Appendix A and refer to:

http://vaww.infoshare.va.gov/sites/VHACancerRegistrars/Reference%20Library/.

NOTE: This is an internal VA Web site that is not available to the public.

d. Typically, reportable malignancies have an ICD-O-3 behavior code of 2 (in situ) or 3 malignant. This could change as newer versions are available. VACRS facilitates compilation of accurate incidence statistics, comparison of system wide outcomes with national standards, analysis of specific therapies and outcomes, evaluation of prevention practices, and planning for resource allocation. It also assists in providing analytic reports and contributes to nationwide cancer information.

e. VACRS data and its reporting to the State Cancer Registries helps ensure a complete understanding of the national cancer burden and mortality. NOTE: VA has determined that VA medical facilities may report VA cancer data to the States; however, re-disclosure of VA data with patient identifiers by the State to another entity is prohibited under the terms of the required Data Use Agreement. NOTE: For more information on DUA and letter requirements, see Appendix B and C, respectively.

3. DEFINITIONS

a. Eligible Analytical Cases. The eligible cases diagnosed or treated at the medical facility after the registry’s reference date (January 1, 1995) are deemed analytic (Class of Case 00, 10-14 & 20-22). Treatment here includes any component of the first course of treatment (e.g., surgery, radiation, or chemotherapy).

b. Facility Cancer Registrar. The personnel responsible for ensuring that timely and accurate cancer registry data is maintained.

c. VA Cancer Registry System Personnel. Personnel responsible for the operation of VACRS, by ensuring that complete, timely and accurate cancer registry data is maintained. NOTE: VACRS personnel may be a cancer registrar or belong to another job series.

4. POLICY

It is VHA policy that data regarding all VA patients diagnosed as having cancer be gathered and reports generated in a systematic and standardized manner to facilitate follow-up, outcome evaluation, program assessment, reporting, and data sharing to strengthen oncology care. NOTE: Procedures for the release of VA data to State cancer registries can be found in the appendices.

5. RESPONSIBILITIES

a. Under Secretary for Health. The Under Secretary for Health is responsible for ensuring overall VHA compliance with this directive.

http://vaww.infoshare.va.gov/sites/VHACancerRegistrars/Reference%20Library/

b. Deputy Under Secretary for Health for Operations and Management. The Deputy Under Secretary for Health for Operations and Management is responsible for:

(1) Communicating the contents of this directive to each of the Veterans Integrated Services Networks (VISN).

(2) Ensuring that each VISN Director has sufficient resources to fulfill the terms of this directive for all of the VA medical facilities within that VISN. NOTE: A recommended registrar staffing ratio is 1 FTE per 350 new analytical cancer cases per year. Consideration of other staffing data, such as the 2011 National Cancer Registrars Association Workload and Staffing Study, may be appropriate (http://www.ncra-usa.org/). NOTE: This Web site is outside VA control and may not confirm to Section 508 of the Rehabilitation Act of 1973.

(3) Providing oversight of VISNs to assure compliance with this directive, relevant standards, and applicable regulations.

c. Chief Officer, Specialty Care Services. The Chief Officer, Specialty Care Services is responsible for:

(1) Developing and maintaining policies and procedures related to the VA Cancer Registry System, and ensuring sufficient resources for operation of VACRS within the Office of the National Program Director for Oncology.

(2) Working with the System Supervisor of the VACRS to ensure that standardized information is gathered regarding all VA patients diagnosed as having cancer.

d. System Supervisor, for VA Cancer Registry System. The System Supervisor for the VA Cancer Registry System (VACRS) is responsible for:

(1) Determining the minimal set of data elements to be collected by facility level cancer registries and the timeline for the reporting of this data to VACRS.

(2) Collecting cancer registry data from all facilities and producing a report on the performance of VACRS, including case counts and trends at least once every five years.

(3) Notifying facility directors when completeness, timeliness, or quality of registry data is deficient.

(4) Overseeing training of VA cancer registrars and upon request with funding from a facility providing training in the use of OncoTrax (or other VACRS approved software) and other duties of a VA cancer registrar. Cancer registry duties are highly distinct from medical record coding and related health information functions. NOTE: Completion and maintenance of a certification program, such as the Certified Tumor Registrar® program offered by the National Cancer Registrars Association https://www.ncra-usa.org/, is strongly recommended. NOTE: This Web site is outside VA control and may not confirm to Section 508 of the Rehabilitation Act of 1973.

http://www.ncra-usa.org/ http://www.ncra-usa.org/ https://www.ncra-usa.org/ https://www.ncra-usa.org/

(5) When releases are requested from the VACRS by a State, obtaining a Data Use Agreement (DUA) , as well as a signed, written request letter from the State on State Agency letterhead in order for VA to release or disclose data to a State Cancer Registry. NOTE: The VA medical facility Director also holds this responsibility. The system supervisor may request assistance from the VA medical facility Director as needed. NOTE: Follow Appendices B and C about obtaining a Data Use Agreement and a signed, written request letter from the State on State Agency letterhead.

e. National Program Director for Oncology. The National Program Director for Oncology is responsible for:

(1) Overseeing management of the VACRS.

(2) Generating reports on the status of cancer incidence and oncology care in VHA.

f. Veterans Integrated Service Network Director. The VISN Director is responsible for ensuring that abstracting and registry reporting activities within the VISN is performed in a timely manner as outlined in this directive.

g. VA Medical Facility Director. Each VA medical facility Director is responsible for:

(1) Establishing a facility cancer registry that reports or provides complete, timely (as determined by the System Supervisor, VACRS) and accurate cancer registry data electronically to the VACRS.

(2) Ensuring that facility registries utilize OncoTraX software (or other VACRS approved software) to ascertain cases, abstracting required data, and generating reports.

(3) Ensuring that there is a facility procedure manual that includes software for the cancer registry functions and a quality control plan for the registry data consistent with VACRS requirements.

(4) Ensuring that facility cancer registry staff receives appropriate training and competencies for VA cancer registry operation.

(5) Ensuring abstraction of at least 90 percent of cases within 6 months of first contact with the facility.

(6) Ensuring that at least 90 percent of eligible analytical cases required to have follow-up information are updated at least annually.

(7) Partnering with another facility to provide cancer registry services when their facility has a small number of patients receiving cancer treatment.

(8) Complying with all required actions and items in this directive to include VACRS designated software installation and training in an appropriate and timely manner.

(9) Receiving notification of cancer registry deficiencies from the System Supervisor of VACRS for their facility and curing such deficiencies in a timely manner.

(10) When releases are requested from a VA medical facility, obtaining a Data Use Agreement (DUA), as well as a signed, written request letter from the State on State Agency letterhead in order for VA to release or disclose data to a State Cancer Registry. NOTE: The System Supervisor, VACRS also holds this responsibility. The VA medical facility Director, when requested by the System Supervisor, VACRS will step in to obtain a DUA with the components (discussed above). NOTE: Follow see Appendix B and C for information about on obtaining a DUA.

h. VA Facility Cancer Registrar. The facility cancer registrar is responsible for:

(1) Operating the facility cancer registry and ensuring that complete, timely, and accurate cancer registry data is maintained and reporting cases with a diagnosis on the reportable diagnoses list.

(2) Producing a facility procedure manual for the facility cancer registry.

(3) Following standards endorsed by VACRS, including reporting cases with a diagnosis on the reportable list, use of software, and standards of North American Association of Central Cancer Registries.

(4) Requesting training, as needed, for VA Cancer Registry System operation.

(5) Providing cancer registry data for operational and research purposes after working with the facility privacy officer to confirm that there is of appropriate authorization to do so, such as a valid standing written request letter and a data use agreement.

a. VHA Privacy Officer. For requests for release of VHA cancer registry data to a State originating from VA Central Office and VHA, the VHA Privacy Officer is responsible for the items below. For requests originating from VA facilities, the VA medical facility Privacy Officer is responsible for the items below. The privacy officer is responsible for:

(1) Ensuring that there is authority to disclose health information to the State cancer registry.

(2) Reviewing the standing written request letter from a State Cancer Registry, executed on the state agency’s official letterhead, to ensure that they are valid for three years. NOTE: It is the responsibility of the System Supervisor, VACRS and the VA medical facility Director to ensure the all required components (listed above) are included. The facility privacy officer reviews the letter to ensure its accuracy.

(3) In collaboration with the Information System Security Officer ( ISSO), reviewing all DUAs, prior to signature, to ensure compliance with VHA Directive 1605.01, Privacy and Release of Information, dated August 31, 2016, and VHA Handbook 1080.01, Data

Use Agreements, dated November 20, 2013. NOTE: See Appendices B and C for DUA template and letter requirements and procedures.

j. VA Medical Facility Information System Security Officer. The VA medical facility Information System Security Officer is responsible for:

(1) Ensuring that the electronic transfer of data from VHA to a State cancer registry is accomplished in a secure manner in accordance with VA Handbook 6500, Risk Management Framework for VA Information Systems – Tier 3: VA information Security Program, dated March 10, 2015.

(2) In collaboration with the Privacy Officer, reviewing all Data Use Agreements, prior to signature, to ensure compliance with VHA Directive 1605.01, Privacy and Release of Information, dated August 31, 2016, and VHA Handbook 1080.01, Data Use Agreements, dated November 20, 2013. NOTE: See Appendices B and C for DUA template and letter requirements and procedures..

k. VHA Personnel. All VHA personnel are responsible for ensuring their use of cancer registry data is in compliance with all Federal laws and regulations, VA regulations and policies, national VHA policies and local (VISN , VHA program office, and VA medical facility) policies including VHA Directive 1080, Access to Personally Identifiable Information in Information Technology Systems, dated January 6, 2017 and VA Handbook 6500 Risk Management Framework for VA Information Systems – Tier 3:

VA Information Security Program, dated March 10, 2015 (see Appendix D, Department of Veterans Affairs National Rules of Behavior).

6. TRAINING

a. The SEER*Educate training is recommended for all VA cancer registrars. It is available from the National Cancer Institute’s Surveillance, Epidemiology, and End Results Program at https://seer.cancer.gov/training/.

b. Additional training resources appropriate for VA cancer registrars are available from:

(1) American Health Information Management Association (AHIMA) CTR Management Course at http://www.ahima.org/education/onlineed/Programs/crm.

NOTE: This Web site is outside VA control and may not confirm to Section 508 of the Rehabilitation Act of 1973.

(2) National Cancer Registrars Association (NCRA) Center for Cancer Registry Education at http://www.cancerregistryeducation.org/encore-2015. NOTE: This Web site is outside VA control and may not confirm to Section 508 of the Rehabilitation Act of 1973.

(3) North American Association of Central Cancer Registries (NAACCR) Educational Products (CTR Preparation & Review) at https://www.naaccr.org/. NOTE: This Web https://seer.cancer.gov/training/ http://www.ahima.org/education/onlineed/Programs/crm http://www.cancerregistryeducation.org/encore-2015 https://www.naaccr.org/ site is outside VA control and may not confirm to Section 508 of the Rehabilitation Act of 1973.

(4) American Joint Committee on Cancer (AJCC) Registrar Education at https://cancerstaging.org/CSE/Registrar/Pages/default.aspx. NOTE: This Web site is outside VA control and may not confirm to Section 508 of the Rehabilitation Act of 1973.

NOTE: It is the responsibility of the national program office to own, develop, and make available all training products. This responsibility cannot be delegated to the VISN or facilities.

7. RECORDS MANAGEMENT

All records regardless of format (e.g., paper, electronic, electronic systems) created by this directive shall be managed per the National Archives and Records Administration (NARA) approved records schedules found in VA Records Control Schedule 10-1. Questions regarding any aspect of records management should be addressed to the appropriate Records Manager or Records Liaison.

8. REFERENCES

a. Pub. L.104-191.

b. 5 U.S.C. 552a.

c. 38 U.S.C. 5701(f)(2) and 7301(b).

d. VA Handbook 6500 Risk Management Framework for VA Information Systems – Tier 3: VA Information Security Program, dated March 10, 2015.

e. VA Handbook 6500, Risk Management Framework for VA Information Systems – Tier 3: VA information Security Program, dated, March 10, 2015.

f. VHA Directive 1080, Access to Personally Identifiable Information in Information Technology Systems, dated January 6, 2017.

g. VHA Directive 1605.01, Privacy and Release of Information, dated August 31, 2016.

h. VHA Handbook 1080.01, Data Use Agreements, dated November 20, 2013.

i. 2011 National Cancer Registrars Association Workload and Staffing Study;

http://www.ncra-usa.org/Portals/68/PDFs/Workforce%20-- %20Hospital%20Workload%20Summary.pdf?ver=2017-05-16-202950-697. NOTE:

This linked document is outside VA control and may not conform to Section 508 of the Rehabilitation Act of 1973.

https://cancerstaging.org/CSE/Registrar/Pages/default.aspx http://www.ncra-usa.org/Portals/68/PDFs/Workforce%20--%20Hospital%20Workload%20Summary.pdf?ver=2017-05-16-202950-697 http://www.ncra-usa.org/Portals/68/PDFs/Workforce%20--%20Hospital%20Workload%20Summary.pdf?ver=2017-05-16-202950-697

j. North American Association of Central Cancer Registries; https://www.naaccr.org/.

NOTE: This Web site is outside VA control and may not confirm to Section 508 of the Rehabilitation Act of 1973.

https://www.naaccr.org/

A-1

APPENDIX A

VA CANCER REGISTRY SYSTEM REPORTING

1. Annually, the VA Cancer Registry System (VACRS) will prepare and distribute a list of reportable diagnoses (found in the International Classification of Diseases - Oncology (ICD-O-3) manual), from the data collected from each VA medical facility cancer registry, on patients diagnosed (clinically or pathologically) and/or treated for diseases outlined in the current VA Cancer Reportable list. Each facility tumor registry will be responsible for including cases with a diagnosis on the reportable diagnoses list. Refer to: http://vaww.infoshare.va.gov/sites/VHACancerRegistrars/Reference%20Library/.

NOTE: This is an internal VA Web site that is not available to the public.

2. Cases not currently required by VACRS (refer to current reportable list):

a. Patients seen only in consultation to establish or confirm a diagnosis.

b. Patients who receive transient care to avoid interruption of treatment started elsewhere.

c. Patients with active, previously diagnosed cancers who are admitted to the hospital for an unrelated condition.

d. Patients admitted to hospice/terminal care only.

http://vaww.infoshare.va.gov/sites/VHACancerRegistrars/Reference%20Library/

B-1

APPENDIX B

DATA USE AGREEMENT (DUA) WITH NON-FEDERAL ENTITIES

NOTE: The most current version of the DUA with Non-Federal Entities should be used and is available from http://vaww.vhadataportal.med.va.gov/PolicyAdmin/DataUseAgreements/DataUseAgree mentTemplates.aspx. This is an internal VA Web site that is not available to the public.

The description of the project should indicate performance of required public health reporting in the recipient State cancer registry and should not include research. Further, the DUA should include a provision that the Requestor (i.e., State cancer registry) or others with access to the provided data are not to contact any Veteran using information provided by VHA.

AGREEMENT FOR DATA EXCHANGE BETWEEN VETERANS HEALTH

ADMINISTRATION (VHA), <INSERT FACILITY OR PROGRAM OFFICE NAME>

AND <INSERT NON-FEDERAL ENTITY NAME>

Purpose: This Agreement establishes the terms and conditions under which the VHA <INSERT FACILITY/PROGRAM OFFICE NAME> will provide, and <INSERT ENTITY NAME>, its contractors and agents, will use VHA data <PROVIDE DESCRIPTION OF

PROJECT INCLUDING TYPE OF DATA AND HOW IT WILL BE USED>.

TERMS OF THE AGREEMENT:

1. This Agreement is by and between <INSERT ENTITY NAME>, its contractors and agents (hereafter the “Requestor”) and the VHA <INSERT FACILITY OR PROGRAM OFFICE NAME> (hereafter the “VHA”), a component of the U.S. Department of Veterans Affairs.

2. This Agreement supersedes any and all agreements between the parties with respect to the transfer and use of data for the purpose described in this agreement, and preempts and overrides any instructions, directions, agreements, or other understanding in or pertaining to any other prior communication with respect to the data and activities covered by this Agreement.

3. VHA will retain ownership of the original data and <INSERT ENTITY NAME> will receive a copy. Data transferred under this agreement becomes the property of

<INSERT ENTITY NAME>.

4. Upon completion of the project, or at the request of VHA after making an ownership decision, the Requestor will securely return or destroy, at VHA option, all data gathered, created, received or processed.

5. <INSERT NAME OF OFFICIAL AND ENTITY> will be responsible for the observance of all conditions of use and for establishment and maintenance of appropriate administrative, technical and physical security safeguards to prevent unauthorized use and to protect the confidentiality of the data. The Requestor agrees to notify the VHA within fifteen (15) days of any change in the named Requestor.

http://vaww.vhadataportal.med.va.gov/PolicyAdmin/DataUseAgreements/DataUseAgreementTemplates.aspx http://vaww.vhadataportal.med.va.gov/PolicyAdmin/DataUseAgreements/DataUseAgreementTemplates.aspx

APPENDIX B

B-2

6. VHA will ensure the secure transfer of the data to <INSERT NAME OF OFFICIAL AND ENTITY>. The method of transfer will be: <INSERT METHOD OF TRANSFER>.

The following named individuals are designated as their agencies’ Points of Contact for performance of the terms of the Agreement. All questions of interpretation or compliance with the terms of this Agreement should be referred to the VHA official named below.

VHA’s Point-of-Contact on behalf of <INSERT FACILITY/PROGRAM OFFICE

NAME>

Name:

Title:

Telephone:

Other Points-of-Contact on behalf of <INSERT FACILITY/PROGRAM OFFICE

NAME>

Name:

Title:

Telephone:

Points-of-Contact on behalf of <INSERT NON-FEDERAL ENTITY NAME> Name:

Title:

Telephone:

7. In the event VHA determines or has a reasonable cause to believe that the Requestor disclosed or may have used or disclosed any part of the data other than as authorized by this Agreement or other written authorization from the person designated in item number 5 of this Agreement, VHA in its sole discretion may require the Requestor to: (a) promptly investigate and report to /VHA the Requestor’s determinations regarding any alleged or actual unauthorized use or disclosure, (b) promptly resolve any problems identified by the investigation; (c) if requested by VHA, submit a formal response to an allegation of unauthorized disclosure; and (d) if requested, return VHA’s data files to the Data Owner. If VHA reasonably determines or believes that unauthorized disclosures of Data Owner’s data in the possession of Requestor have taken place, the VHA may refuse to release further data to the Requestor for a period of time to be determined by VHA, or may terminate this Agreement.

8. Access to the VHA data shall be restricted to authorized <insert Entity name> employees, contractors, agents and officials who require access to perform their official duties in accordance with the uses of the information as authorized in this Agreement.

Such personnel shall be advised of: (1) the confidential nature of the information; (2) safeguards required protecting the information; and (3) the administrative, civil and criminal penalties for noncompliance contained in applicable Federal laws. The Requestor agrees to limit access to, disclosure of and use of all data provided under this Agreement. The Requestor agrees that access to the data covered by this

B-3

Agreement shall be limited to the minimum number of individuals who need the access to the Information Owner’s data to perform this Agreement.

9. <INSERT ENTITY NAME>, its contractors or agents, will protect the privacy and confidentiality of any individually identifiable information contained in the data consistent with the Privacy Act of 1974, and, to the extent applicable, standards promulgated pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), 38 U.S.C. 5701(f),and other applicable laws, regulations, and policies. The Requestor may provide data access to appropriate employees, contractors, and other authorized Requestors. Except as may be required in a public health emergency to protect life and health of individuals and populations, and for authorized follow-up activities described herein, the Requestor will not attempt to identify the individuals whose records are contained in the data provided under this agreement or link these data with other data sources for identification purposes.

10. The information provided may not be disclosed or used for any purpose other than as outlined in this Agreement. If the Requestor wishes to use the data and information provided by VHA under this Agreement for any purpose other than those outlined in this Agreement, the Requestor shall make a written request to VHA describing the additional purposes for which it seeks to use the data. If VHA determines that the Requestor’s request to use the data and information provided hereunder is acceptable, VHA shall provide the Requestor with written approval of the additional use of the data.

11. The Requestor hereby acknowledges that criminal penalties under § 1106(a) of the Social Security Act (42 U.S.C. § 1306(a)) may apply to disclosures of information that are covered by § 1106 and that are not authorized by regulation or by Federal law. The Requestor further acknowledges that criminal penalties under the Privacy Act (5 U.S.C.

§ 552a(i)(3)) may apply if it is determined that the Requestor, or any individual employed or affiliated therewith, knowingly and willfully discloses VHA’s data. Finally, the Requestor acknowledges that criminal penalties may be imposed under 18 U.S.C. § 641 if it is determined that the Requestor, or any individual employed or affiliated therewith, has taken or converted to his own use data file(s), or received the file(s) knowing that they were stolen or converted.

12. Authority for <INSERT PROGRAM OFFICE> to share this data for the purpose indicated is under the HIPAA Privacy Rule, is <INSERT LEGAL CITATION>, under the Privacy Act is <INSERT LEGAL CITATION OR ROUTINE USE FROM THE APPLICABLE PRIVACY ACT SYTEM OF RECORD> and under 38 USC 5701 <INSERT LEGAL CITATION> and 38 USC 7332 <INSERT LEGAL CITATION, IF THIS

STATUTE IS APPLICABLE>.

13. <INSERT ENTITY NAME> will ensure that its contractors and agents abide by the terms and conditions of this agreement. The VA or VHA may request verification of compliance.

B-4

14. The terms of this Agreement can be changed only by a written modification to the agreement by the agency signatories (or their designated representatives) to this Agreement or by the parties adopting a new agreement in place of this Agreement.

15. This Agreement may be terminated by either party at any time for any reason upon 30 days written notice. Upon such notice, VHA will notify the Requestor to destroy or securely return such data at Requestor’s expense using the same procedures stated in the above paragraph of this section.

16. On behalf of both parties the undersigned individuals hereby attest that he or she is authorized to enter into this Agreement and agrees to all the terms specified herein.

INSERT NAME OF ENTITY SIGNER Date

INSERT TITLE OF ENTITY SIGNER

INSERT PROGRAM OFFICE OF ENTITY

INSERT NAME OF ENTITY

INSERT NAME OF VHA SIGNER Date

INSERT TITLE OF VHA SIGNER

INSERT VHA PROGRAM OFFICE

Veterans Health Administration

Concur/Non-Concur:

INSERT NAME OF VHA PROGRAM OFFICE ISO

Signature Date

Concur/Non-Concur:

INSERT NAME OF VHA PROGRAM OFFICE PRIVACY OFFICER

Signature Date

C-1

APPENDIX C

LETTER REQUIREMENTS

The VA medical facility Director (in the case of release from a VA medical facility) or the VA Cancer Registry System Supervisor (in the case of release from the VA National Oncology Program Office) must follow the following procedures:

a. Names, addresses, and health information of patients with cancer are not disclosed to a State Public Health Authority, such as a State Cancer Registry, unless an appropriate standing written request letter is received and a DUA is executed. A standing written request letter is valid for 3 years, at which time it must be reissued. NOTE: See Appendix B for DUA template.

b. Written request from the state must be on the state agency’s official letterhead, includes:

(1) A citation of the State law that requires health care providers to report names, addresses, and health record data to the State Cancer Registry and the State law that authorizes the State to enforce or compel compliance with the cancer reporting requirement, e.g., power to sanction or issue cease and desist orders;

(2) The purpose of the request and agreement that the State will not allow the VA information to be utilized for any other purpose than that stated in the request;

(3) A statement that the organization, agency, or instrumentality is aware of the penalty provision of 38 U.S.C. 5701(f); and

(4) The signature of the head of the agency or official designee.

c. Electronic transfer of data is accomplished in a secure manner in accordance with VA Handbook 6500, Risk Management Framework for VA Information Systems

– Tier 3: VA information Security Program, dated, March 10, 2015.

d. The Information System Officer (ISAO) and Privacy Officer (PO) reviews all DUAs before they are signed to ensure that they comply with VHA Directive 1605.01, Privacy and Release of Information and VHA Handbook 1080.01, Data Use Agreements. NOTE: VA medical facility staff should seek the assistance of the District Counsel, , when evaluating the applicable law relative to the statutory authority of the State Cancer Registry to require cancer reporting and to enforce compliance with the reporting requirement.

e. That a DUA for the Release of Data (see Appendix B) is completed and signed. The DUA must address the:

(1) Use or purpose of the requested VA data;

(2) Safeguards the State intends to employ to protect the VA data in their possession. These safeguards must address Health Insurance Portability and Accountability Act of 1996 (HIPAA) security rule compliant controls that are

APPENDIX C

C-2 implemented to protect the information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction;

(3) State’s authorized use and disclosure of the VA data;

(4) Security requirements necessary for transporting or transmitting the VA data to the State in accordance with VA Handbook 6500;

(5) Procedures for reporting any data breaches to VA; and

(6) State point(s) of contact for all data exchange and security related issues.

(7) That a copy of the completed DUA is provided to the VA Cancer Registry System Supervisor.